linux-kernel - Re: NFSv3 directory traversal causes lockup in 4.9.214

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f9afd297-24d7-0343-6bdf-b2ead1cedc0f@kite.hu>
Date:   Sun, 22 Mar 2020 08:03:12 +0100
From:   Bartos-Elekes Zsolt <muszi@...e.hu>
To:     Trond Myklebust <trond.myklebust@...marydata.com>,
        Anna Schumaker <anna.schumaker@...app.com>,
        linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: NFSv3 directory traversal causes lockup in 4.9.214

Hi!

> I think I found a bug in 4.9.214: a simple directory traversal of a NFSv3-mounted filesystem causes system lockup after 
> a few seconds - everything attempting NFS and local disk access is blocked. The machine is still alive (responding to 
> pings and on the console), but I can't start any new programs.
> 
> 
> 4.9.213 is OK, 4.9.214 is not.
> 
> If we revert commit 67a56e9743171bdacddbdc05a58735aa024bb474 (commit 4b310319c6a8ce708f1033d57145e2aa027a883c upstream), 
> the problem goes away.
> 
> 
> How to trigger the problem:
> 
> mount nfs-server.example.com:/ /mnt/net -o vers=3,ro
> find /mnt/net
> 
> 
> I have observed this only on two older machines running in i386 mode (my home server, an Intel D2500HN, and a test 
> machine, a Lenovo ThinkCentre A57 (Product ID: 9851-7AG)), but could not trigger the bug on a Pentium III machine (all 
> three running the very same kernel).

I reply to myself: commit dbfc9e9878561da92cdcda41f321137c16966587 ("NFS: Remove superfluous kmap in 
nfs_readdir_xdr_to_array") in 4.9.217 fixes it.

-- 
Best regards,
Zsolt